<Table "process_file_events" returns nothing> Hi e...
# community-feeds
r
Table "process_file_events" returns nothing Hi everybody, I'm currently doing a thesis at uni about system administration, and my professor wants me to study and use osquery for socket and process auditing and for file integrity monitoring. For the FIM part, I wanted to use the the "process_file_events" table because I think it contains the most useful informations. I am running osquery on Debian 12, and to start it I use the following line with superuser privileges: osqueryi\ --verbose\ --audit_allow_fim_events=true\...